[FIXED] How to dynamically populate CORS_ORIGIN_WHITELIST from the database with django-cors-headers?

Issue

I am writing a django application where I have a model called Website which contains websites of people. I only allow people who have their websites in my database to use my Django REST API. I am using the django-cors-headers package to whitelist the domains of people: https://github.com/adamchainz/django-cors-headers.

CORS_ORIGIN_WHITELIST variable in settings.py allows me to white list domains as shown in https://github.com/adamchainz/django-cors-headers#cors_origin_whitelist

The problem is that I have to query my models to get the website domains, append them to a list and then put that list into CORS_ORIGIN_WHITELIST. But I can't do that in settings.py because models are loaded after the app starts and settings.py is the one that starts the app.

Does anyone know a way around that? Any suggestions will be appreciated. Thanks in advance.

Solution

django-cors-headers has a signal that allows you to decide whether or not to allow the request to pass. The docs show exactly your use case.

Note that CORS_ORIGIN_WHITELIST is also checked by the cors middleware (the signal response doesn't replace the white list), so you can have both: a static whitelist + a dynamic whitelist that depends on the request. You don't need to check the static whitelist in your signal handler.

Answered By - dirkgroten